CVE-2013-6945 Auth bypass in n/a
Attackers can bypass authentication to perform doctor-only actions and read or modify patient records in the OSEHRA VistA M2M Broker.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-6945?
CVE-2013-6945 is a high-severity authentication bypass vulnerability in n/a, published on 4 Dec 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The M2M Broker in OSEHRA VistA, as distributed before September 30, 2013, allows attackers to bypass authentication and authorization to perform doctor-only actions and read or modify patient records via unspecified vectors related to a "logic flaw."
Weakness: CWE-264
Which versions are affected by CVE-2013-6945?
It affects 1 product.
Products include Osehra Vista.
How do I fix CVE-2013-6945?
No fix has been published for CVE-2013-6945 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2013-6945 being exploited?
There is no known exploitation of CVE-2013-6945 in the wild and no public exploit code.
Sources
Also known as GHSA-4pxw-f4xf-x8h5.